IT Security & Privacy

The Dutch Data Protection Authority (AP) reviewed the Dutch Healthcare Authority's draft Mental Health Care and Forensic Care Regulations (NR/REG-2705a) and issued no comments. The clean review suggests the draft's personal data processing provisions meet the AP's GDPR and proportionality framework. It also shows compliance teams how the AP tests health-related data processing in legislative proposals.

The Companies Auditors Disciplinary Board (CADB) suspended former PKF Brisbane Audit partner Cameron Bradley until 30 June 2028, effective 15 September 2026. It also reprimanded him and ordered undertakings and costs. The decision found fundamental failures in the audits of three managed investment schemes and reinforces ASIC's focus on audit quality, valuation practices, and auditor misconduct, particularly in private markets.

The SEC upgraded EDGAR to Release 26.3 on September 14, 2026, adding support for the 2026q3 Fund (FND) taxonomy and ending acceptance of all 2024 taxonomy versions, including quarterly releases. Filers still using 2024 taxonomies in their XBRL submissions risk filing rejections, so compliance and reporting teams should confirm their filing tools and templates are updated.

The Dutch Data Protection Authority (AP) has published its enforcement policy after receiving questions from organizations about how it conducts proceedings against those suspected of violating privacy rules.

Poland's data protection authority (UODO) and the Social Insurance Institution (ZUS) will co-host a free seminar on September 24, 2026, on controller responsibilities for collecting, storing, and disclosing personal data in digital administration. The event is not a new rule, but it signals UODO's current supervisory priorities, including lawful processing and digital sovereignty in the age of AI. Compliance teams with Polish operations should treat it as an informal view into regulatory expectations.

Spain's National Commission on Markets and Competition (CNMC) has approved two methodologies for assessing cybersecurity risks and classifying attacks on electricity networks, a step toward identifying the companies that will face additional security requirements under European Union rules.

The UK Information Commissioner's Office (ICO) has confirmed a live investigation into whether Police Scotland is meeting its legal obligations when handling subject access requests (SARs), including statutory response timescales. Although the matter concerns a law enforcement body, it signals continued regulatory focus on SAR compliance that financial institutions should treat as a prompt to review their own processes.